Cypress, Ltd.Data Security & Privacy - Cypress, Ltd.
Cypress, Ltd.

Data Security & Privacy - Cypress, Ltd.

The Cypress Customer Service Center operates 24/7/365 and handles a large range of client and customer information and as a matter of policy, we take database security and privacy very seriously.

Cypress Storing of info and securitySystem Security

We have deployed a Managed Host-Based Intrusion Prevention System (MHIPS) to protect all workstations and servers. By utilizing best-in-breed technology from DigiTrust Group, we have a high level of defense against viruses, spyware, Trojan horses and other malware, no matter where we’re plugged in.

  • Advanced Security Protection for Workstations and Servers
  • Industry-leading protection against malicious software, 0-day exploits and direct hacker attacks
  • Cutting-edge intrusion prevention, detection and blocking in real-time
  • Industry-unique constant system scanning issues alerts for insecure configurations, missing patches and other basic vulnerabilities
  • Security monitored 24 x 7 by dedicated information security professionals
  • Security monitoring software custom configured to our unique IT needs
  • Real-time security monitoring of our workstations and servers alert for any security threats

We also comply with Payment Card Industry (PCI) Data Security Standards through its interactions with credit card processors, such as, and financial institutions, such as Wells Fargo, Bank of America, etc. In addition, all customer information is kept secure and meets all requirements of the FACT Act (2003), which set standards for guarding customer information in support of the prevention, detection and mitigation of identity theft. All of CSC personnel have been trained on the Identity Theft Prevention Programs of each of its client utilities and Red Flags procedures. Our servers, firewalls and networks are also scanned by Trustwave for PCI compliance.

Disaster Recovery and Continuity of Operations

  • CSC Security servers

    All servers synchronize data between each node. In the case of a server crash, the remaining nodes continue replication until the downed server comes back online

  • The Customer Service Center has multiple redundant servers as well as multiple redundant T1 lines
  • Uninterruptable Power Supplies (UPS) also power all servers
  • All servers are built with RAID configuration to ensure redundancy in case of drive failures. This setup allows multiple hard drive failures without taking down the system.
  • All database server files are backed up off-site nightly and maintain a 5 week retention period. In addition System State backups are taken to allow critical boot & registry data to be restored upon emergency failure.
  • Onsite and Offsite Backups
  • Local database files are backed up onsite for quick/effective recovery nightly, weekly and monthly.
  • Shadow copies of network drives and database files are created three times a day with offsite backups.
  • Full backups are run during off-peak hours, between 10:00 p.m. and 7:00 a.m., over the Internet using 128-bit SSL encryption during transfer and 448-bit Blowfish encryption once transfer is completed.
  • The backup process encrypts the data locally, before it ever begins transmission, using 256-bit AES security and then establishes an SSL connection to the remote facility to allow transmission.
  • Our solution utilizes “block-level” backups that back up only the smallest changes to a file, allowing more files to be backed up in the same timeframe.
  • Backups are centrally managed from a secure Web console and each critical server has a separate backup client allowing for independent job execution should the centralized management lose connectivity. Notifications are triggered after any backup job has a warning or failure to ensure immediate response in fixing any anomalies.
  • System maintenance is performed routinely to ensure all updates are performed.
  • Offsite data storage safeguards
  • Twenty-four seismic base isolators are reinforced by seismic slider bearings capable of withstanding a 7.5 magnitude earthquake.
  • Located in Los Angeles, California with mirrored drives in Boston, Massachusetts.
  • Fire Detection & Suppression uses an INERGEN® waterless fire suppression system.
  • Power is maintained by four redundant 500 KVA Leibert UPS systems, twelve redundant PDU systems, a DC power rectifier and an ATS. Power is guaranteed by three 1.7 Megawatt generators fueled by 10,000 gallons of diesel.
  • Business continuity is assured through offsite terminal servers and are available for remote connection.

Disaster Recovery Scenarios

  • Database file is corrupted – Action: Diagnose corruption date/time and restore an off-site backup of the database with the appropriate transaction logs to allow up-to-date restoration of the file.
  • Hard drive failure in data store – Action: Due to the RAID level, we are notified of the failed drive and have the ability to order, receive and replace the damaged drive without the need for downtime or customer interruption.
  • Operating System Corruption – Action: Install Windows Server, perform an night backup restore of the system state, verify accessibility and resume customer access. Due to the RAID level, if the operating system completely crashes, the data still remains intact as it is stored on a separate set of drives.

Our servers, firewalls  and networks are scanned by Trustwave for PCI compliance.

Digitrust logo


Authorize.NET logo


Other Security

Physical Controls
Cypress works with a multitude of confidential information and customer records, all of which must have the strictest privacy and security protocols in handling such information. The CSC facility located in Hemet, CA has completed site inspections in compliance with client utility programs, and we will implement the same procedures to protect new account credentials from unauthorized disclosure. Access to the server room is restricted to prevent physical malicious access.

Personnel Security
All personnel have to comply with background checks before employment. All CSRs also must provide current documentation and Cypress conducts extensive due diligence on employees.